Is Internal Audit a Strategic Function?

Can it play an Effective Role in the Organizations Strategic

Planning?

Published on August 20, 2014

LikeIs Internal Audit a Strategic Function? Can it play an Effective Role in the Organizations
Strategic Planning?

Rajeswaran Muthu Venkatachalam

A good two part question, but the answers may be varied based on the internal auditors thought
process as well as the current practices s/he is aware of in this area.

Lets examine in this article the trends, best audit practices and literature available on this very
important subject.

First, given that the International Standards for the Professional Practice of Internal Auditing (Standards)
requires internal audit to adopt a risk-based approach to its audit plan, it is appropriate for internal
audits activities to be aligned to the organizations strategy.

Then, what is strategic management?

Strategic management is both visionary and practical and, at its best, finds an effective balance between
these two poles. The functions of strategic management primarily revolve around setting a direction for
your company, guiding the company as it moves in the direction that has been outlined and evaluating
and adjusting the articulated direction as the business and its environment evolve. Strategic
management is based on leadership that encourages all managers and employees to continually learn,
individually and as a group.

What is Internal Audit Strategy?

Strategy is a means of establishing the organizations purpose and determining the nature of the
contribution it intends to make while predefining choices that will shape decisions and actions. Strategy
for the internal audit activity enables the allocation of financial and human resources to help achieve
these objectives as defined in the activitys vision and mission statements (which contribute to the
achievement of the organizations objectives).

This benefit the internal audit activity through its unique configuration of resources aimed at meeting
stakeholder expectations. The strategy itself is part of the set of matters to be reported to senior
management and the board. This responsibility falls under the scope of Standard 2060: Reporting

to Senior Management and the Board, which establishes that the chief audit executive must report
periodically to senior management and the board on the internal audit activitys purpose, authority,
responsibility, and performance relative to its plan.

Therefore, what should be the approach of internal audit?

When an organization is moving with a strategic vision, its appropriate for the internal audit function
also to move with the same philosophy and direction. Internal Audit should have a strategic mission,
goals and plans that matches with the corporate philosophy.

The IIAs IPPF Practice Guide issued earlier in this regard states:

For internal audit to remain relevant, it should adapt to changing expectations and maintain alignment
with the organizations objectives. The internal audit strategy is fundamental to remaining relevant
playing an important role in achieving the balance between cost and value, while making meaningful
contributions to the organizations overall governance, risk management, and internal controls.

A systematic and structured process can be used to develop the internal audit strategic plan, helping to
enable the internal audit activity to achieve its vision and mission.

The following steps can be used to develop the internal audit strategic plan:

1. Understand the relevant industry and the organizations objectives.

2. Consider the International Professional Practices Framework (IPPF).

3. Understand stakeholder expectations.

4. Update the internal audit vision and mission.

5. Define the critical success factors.

6. Perform a strengths, weaknesses, opportunities, and threats (SWOT) analysis.

7. Identify key initiatives.

Role in the Organizations Strategic Planning:

Talking about the auditors involvement in the organizations strategic planning, the IIAs CBoK study of
2010 has very clearly captured the current trend under the caption Optimizing Internal Auditing:
Leading Practices.

It identified that engaging management throughout the audit process to enhance understanding of
operations, strategy, and strategic initiatives was one of the leading practices as opined by the
participants to this study.

Again under the caption Optimizing Internal Auditing: Strategic Risk and Corporate Governance the
same study said:

Quote:

Regarding strategy risk, internal auditing may not be well connected with the strategic arm of the

Organization and therefore not invited to participate in discussions around strategy and governance.
To overcome this, it can become involved via its risk assessment process. Internal auditings risk

assessment can be expanded to include assessing the strategic risks embedded in the organizations

strategies and also assessing risks related to its governance processes. If the risk assessment is done

properly, the internal audit team will work with management to identify and prioritize both strategic

and governance-related risks and ensure that the audit plan incorporates coverage of these risks.

Another issue may be that internal auditing is intently focused on completing its audit plan to meet

the timing requirements of the audit committee. As such, resources may be constrained, auditors

may be busy managing multiple projects, etc., which may lead to the internal audit group simply

sticking to its plan and not necessarily looking for other areas of risk that pose a threat to the

organization. Keeping current with the organizations activities and aggressively networking within

the rank and file, as well as the executive ranks, could help CAEs identify risks outside the audit

plan that, if warranted, could be communicated appropriately to their internal audit team.

Unquote:

Its therefore very clear that successfully carrying out this assignment will greatly depend on the
following and the like.

(1) Adequacy of Audit Resources

(2) Competency levels of the Auditors

(3) Competing audit priorities

(4) Agreed Audit Plans and the CAEs commitment to complete them and

(5) The audit funding.

Its a continuous learning of best practices:

S/he has to keep understanding and exploring several related questions like the following to be able to
play an effective role in this area in her/his organization. Continuous research in this area and studying
bench marks will greatly help.

Investigating the role played by internal audit in the strategic direction of the organization. (It is
NOT about auditing strategy.)
 Aligning internal audit activities with the strategic objectives of the organization and ensure that
emerging risks and opportunities are considered.

With reference to the Standards, evaluating internal audits role in strategy (risk standards in
particular).

Ensuring internal audit achieves its objective as defined in the internal audit definition (by
adding value and earning a seat at the table) to establish best practice guidelines.

Identifying leading organizations that have integrated their process (implemented strategic
vision with internal audit involvement)

Identifying impediments to internal audit involvement.

Reconciling chief audit executive/internal audit roles in the strategy-setting process versus
independence of the internal audit function.

and keep finding answers to the following questions.

Does internal audit have a role in the organizations strategy? If so, what?

What value can internal audit add in the strategy-setting process?

After strategic planning, what should internal audits role be in the lifecycle of strategy (e.g.,
monitoring), and how does it maintain its independence thereafter?

How does internal audit align its activities to the strategic goals/objectives of the organization
and ensure that material merging risks are considered?

What are the benefits of involving internal audit in strategy to the various stakeholder groups
(i.e., board, audit committee, executive and operational management, and internal audit itself)?

What are the potential pitfalls to avoid (e.g., independence)?

What are the risks of not having internal audit involved in strategy setting?

What are the global leading practices among diverse internal audit groups (e.g., private, public
sector, and non-governmental organizations)?

What does the Standards say (if anything) about internal audit involvement in strategic planning
(either directly or by implication)?

Leverage the Standards (is active involvement in strategy setting a conflict of interest for
internal audit?).

What are the things we need to do once we have a place at the table during strategy setting?

What is Internal Auditings Role in Governance?

There are differing views regarding how internal auditing should be involved with governance

activities; in some cases, it might not play a role at all. Here are some examples regarding internal

auditings involvement in governance. As a CAE, how would you answer these questions?

Creating policy?

Identifying outdated policy?

Setting corporate strategy?

Identifying corporate strategies/initiatives that are not working?

There are adequate numbers of Research Reports that are available in the IIAs Research Stores that
effectively address all of the above questions and can be beneficially used by the internal auditors.

Lets do it ..

Exploring newer areas is always a challenge and at the same time exciting and when completed
rewarding. One of the meanings that a Pyramid conveys is to increase rapidly and progressively step
by step on a broad base. I thought that for internal auditors to remember, this is a great picture.

To conclude, let me say that internal audit could be re-positioned to become a strategic function, play a
vital role in the strategic management process and become a trusted strategic advisor for the
organization.

Charles Bukowski, a great poet & a writer says If youre going to try, go all the way. Otherwise, dont
even start .

Our answer to him is Well start and go all the way!

Best Regards.

Raj...